Archives

Jev does not write anything, cannot be talked into trying, and ships with a published list of its own weaknesses. I have not admired a piece of AI engineering this much in a while, and the reasons are mostly about what it refuses to do.

Caching, batching and routing are the three levers on an inference bill. They are worth roughly ten times, two times and up to a hundred times respectively, and almost everybody reaches for them in the wrong order.

An hour of engineer time buys roughly four million output tokens at top tier rates. Working out where that stops being true, and why the answer has almost nothing to do with which model you picked.

Writing code was never the bottleneck in delivering software. Four pieces into an argument about what the tools changed, here is the larger part of the job they left exactly where it was.

Time saved by accepting a suggestion is immediate, visible and easy to count. The cost of accepting a wrong one is delayed, diffuse and lands on somebody else. Guess which one ends up in the productivity deck.

When an implementation can be regenerated in a minute, it stops being the valuable artefact. The statement of what the system should do is what survives, and most codebases have never written one down properly.

Reviewing generated code is a different skill from reviewing a colleague's work. The errors cluster differently, the social signals are gone, and most of us are using the old technique on the new problem.

Writing code sped up by a large factor. Reviewing it did not speed up at all. Everything teams are complaining about follows from that one asymmetry.

Cedar is an authorisation language that is deliberately less powerful than its competitors, formally verified, and widely assumed to be an AWS only concern. All three of those are why it was the right tool for gating what an AI flow is allowed to do.

The EU's operational resilience regulation for financial services does something new. It reaches past the regulated firm and supervises its cloud providers directly, nineteen of them, including all three hyperscalers. What that changes, and what it does not.

AWS, Azure and Google Cloud hold near identical certificate lists and materially different scopes. A side by side comparison, a control by control mapping of what you still owe, and the three places the mapping usually goes wrong.

UK telecoms security regulation defines two categories of system, one nested inside the other. The distinction is better thinking than most security frameworks manage, and it applies well outside telecoms.

Most detection tools report what they found and say nothing about what they missed. Planting known records is how you get the number nobody will give you.

Macie cannot reliably tell a payment card number from one of your own reference numbers. The privacy argument explains why that is hard to fix with your data, and not why it remains unfixed.

What ISO 42001 actually is, how AI stresses an existing ISO 27001 management system, and where the rules stand across the EU, US, UK, Asia and the Gulf as of late 2026.

The two names look like siblings and are close to opposites. What each inherits from DevOps, what MLOps has to handle that DevOps never did, and an honest answer on how transformational either one is.

If you point a language model at your logs, tickets or alerts, an attacker who can write to any of those is writing part of your prompt. What that enables, and how to contain it.

Two different things get called the stages of AIOps. One is a pipeline, one is a maturity ladder. What each says, where they came from, and how far to trust them.

A plain English introduction to AIOps. What problem it solves, what the tools do, how far the label stretches, and why most of the value arrives before the AI does.